CVE-2019-11547 - An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2

Back Back to CVE browser

MEDIUM

An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2

Published Sep 9, 2019

6.1

MEDIUM

CVSS 3.1

EPSS 1.14%

Description

An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It has Improper Encoding or Escaping of Output. The branch name on new merge request notification emails isn't escaped, which could potentially lead to XSS issues.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-116

CWE-79

Cross-site Scripting (XSS)

References (3)

https://about.gitlab.com/2019/04/29/security-release-gitlab-11-dot-10-dot-2-released/
x_refsource_CONFIRMRelease NotesVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-3218
Advisory
https://gitlab.com/gitlab-org/gitlab-ee/issues/11515
x_refsource_CONFIRMExploitVendor Advisory

Link	Providers	Tags
https://about.gitlab.com/2019/04/29/security-release-gitlab-11-dot-10-dot-2-released/		x_refsource_CONFIRMRelease NotesVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-3218		Advisory
https://gitlab.com/gitlab-org/gitlab-ee/issues/11515		x_refsource_CONFIRMExploitVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Sep 9, 2019

Updated Aug 4, 2024

Reserved Apr 25, 2019

Link CVE-2019-11547

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2019-11547

Red Hat

No data

ENISA EUVD

Assigner mitre

Published Sep 9, 2019

Updated Aug 4, 2024

Link EUVD-2019-3218

GitHub

No data